Meet the man who has brought down prolific internet paedophiles
Some things are so morally reprehensible to so many people that the thought of a right-minded individual being in any way involved is unthinkable. However, spare a thought for the unsung heroes of crime prevention. In particular, the ones who have to watch content that might make the rest of us feel rather unwell.
Andrew Hughes (name changed) is a cybersecurity expert with experience working on some of the most horrific cases known to police. He spoke to VT to tell us what it’s like to be on the front line in the fight against cybercrime.
VT: What are some of the cases that you’ve worked on?
“One of my first cases was for Durham Police. This guy, I think he was a postman, was texting 13 and 14-year-old girls. My job was to prove that he had sent pictures to this girl's phone. That included going through her pictures that she had sent and you have to describe them like ‘girl, believed to be X, in knickers and bra’. So you would have to write about it and it was horrible, especially considering I was only 20 at the time.”
VT: In regards to these cases, would you have to present evidence in court?
“As the job goes, you should always assume that it's going to end up in court. Otherwise, the job didn't concentrate on might end up in court. It’s bad in two ways. Number one, it makes you look bad professionally. You’ve got the whole jury, the law firm, the lawyers, the judge, all the public servants then they say ‘this guy doesn’t know what he’s talking about’. And it’s quite bad on you, too - because you’ll know when you're being torn apart.
"You don’t want to distress the victim, the family or the jury"
“Even if you know that it's for a small thing, the defence lawyer or the prosecution - whoever they’re acting for - will still rip you for that very small error. So you should always assume that it’s going to happen.”
VT: In terms of the kind of child porn cases, did you ever have to describe evidence that wasn't allowed to be shown in court due to its nature?
“So when we when we give reports, we always describe what we find and it’s levelled as well. It's called the COPINE scale - and it’s one to ten, ten being the worst. So you would say ‘I found this many level fives, this many level tens’ etc. Fairly low on the scale you’ve got stuff like ‘pictures of children in a suggestive manner’. It gets worse from there.
“That’s what the police and the CPS [Crown Prosecution Service] use to grade how severe it is. So instead of giving it to them, to save them that hassle, we say ‘we found this many of this type’ and you describe them. So they can look at them if they want, but usually that’s for the courts to consider themselves and decide.”
VT: And that wouldn’t be shown to a courtroom in a semi-public sphere?
“It depends on the case. I think they would omit that if they could. If it was very high profile, they might want to make an example of the person by showing how bad the material is. But usually they would want to try and omit it where possible. You don’t want to distress the victim, the family or the jury.
"People use their phones for everything. It’s more the grooming cases which, if anything, are just as bad"
“The funny thing is, these forensic firms and the police are the only people who are allowed to store this kind of material. So no one else really ever sees it, unless you're the one who's buying it or producing it.”
VT: Do you have an area of speciality when it comes to computer forensics?
“What I specialise in is data theft - so evidence of people stealing material from businesses or in public scenarios as well. Say you borrowed my USB stick. I could prove whether you took some files off there when you shouldn’t have done. Mostly it’s corporate but it can be applied to any sort of scenarios. And mobile devices is another one that I specialise in.”
VT: And is specialising in mobile devices quite important, when it comes to the cases you mentioned with the police?
“Definitely. People use their phones for everything. It’s more the grooming cases which, if anything, are just as bad. In the messages, the person who’s underage will be saying ‘I’m only this age’ to throw them off if they’re being creeped out. And they'll go ‘yeah, I don't mind lol’. They are still fully asking for these things that they shouldn’t be.”
VT: Did you have to have any sort of psychological tests or background checks before working on child abuse cases?
“Nothing, no. I was CRB checked when I joined but that wasn’t subject to my employment. The CRB check was supposed to happen before I started working on the cases but it didn’t. Purely because of workload. They relied on the new staff coming in to manage the workload of people who were leaving at the same time. Otherwise, they fell back and if they fell back, they lost the contracts.
"It's absolutely fine to want to leave because it is quite horrifying stuff. But you just sort of deal with it"
“It was very clear, if you missed four weeks’ worth of deliveries then the contract’s done. So we just had to dive in. Hence that first case that I had. They were literally like ‘this is the only one we can give to you - go’. There was support and there was guidance but you’re pretty much on your own.”
VT: Do you become desensitised to what you’re seeing?
“Yeah, I think you do. And so does anyone else in this job. You know, the child protection people, the police, the counsellors, the lawyers who deal with this sort of thing - I think they all do. You either desensitise yourself and get on with the job or it bothers you and you leave. It's absolutely fine to want to leave because it is quite horrifying stuff. But you just sort of deal with it.”
VT: Is there ever much humour in the office or is the work simply too sombre?
“Yeah, a lot of it. It sounds quite sick, but you do try and have a laugh. It’s difficult to describe. I could definitely tell by humour, by spending a lot of time with someone, without asking, if they’ve done this sort of job. Purely because most of the people I work with would have ended up in that situation anyway but sometimes you know. You’ll say ‘this guy’s a bit sick - he’s probably done police work’.”
VT: The subject matter is still horrendous, so is this a coping mechanism?
“Yeah, definitely. I've seen some people grooming younger people and sending skat pictures and you look at it and it’s pretty sick but you laugh at it. Otherwise, you spend all day with this stuff in your head and it grinds you down quite a lot. Whereas if you get everyone round and everyone says ‘oh, that’s disgusting, that’s horrible’ and have a laugh, then you all sort of calm each other down a bit. You support each other that way.”
VT: Is the case of Matthew Falder, the prolific internet paedophile found guilty of 137 charges, a course for concern when it comes to what's possible using the dark web?
“Yeah. The dark web hasn't been around for that long and you used to have these weird chat rooms which were on the internet. But the dark web is this completely other-side-of-the-spectrum different sort of hole. No one really knows how big it is or what’s on there. It’s not regulated. It’s completely out there.”
VT: Are there are a lot of police operations working against this kind of crime on the dark web?
“Like I said, it's unregulated. But from what I’ve heard, there are undercover dark web guys. A lot of the time, [the perpetrators] meet socially because they know that nothing can attribute them to their contacts because it’s all on the dark web. I have heard of a few attempts to meet up with people - coppers meeting up with paedophiles. Just like any other sting operation.”
VT: Is that a big area of focus for police or is that pretty uncharted waters?
“The fact is, in terms of child protection, that’s a police matter and the police just have no money to deal with that sort of stuff. They’re struggling to deal with people in the streets. They’re certainly not neglecting child protection in terms of digital forensics, but they’re limited in their options when it comes to proactively going out and finding these guys.”
VT: Have there been any big busts or interesting finds in the other cases?“Nothing major but the drugs ones are quite interesting. Back in the day when BlackBerrys were huge, we would have to go through them. Every BlackBerry had a memory card and any media would save onto it. And it’s really easy to recover deleted stuff from these memory cards.
"I think kids shouldn’t be online as young as they are. Especially because it’s just so open. It’s like a playground for anyone"
“So you’d get them and they’re like ‘no, I’m clean, I’ve done nothing wrong’ and they may have had messages on there which said ‘I’ve got this, I’ve got that, let me know if you need anything’ but BlackBerrys had really strong encryption.
“However, the memory card would tell a different story. It would have him wearing a 20 grand chain or with a brand new Beemer, when he’s unemployed, huge bags of weed, huge bags of coke, the girls they were banging… It wasn’t a big bust but it was such a quick win for us - just that little glitch in being able to take things off the memory card and not the phone.”
VT: Do you think social media plays a part in exposing children’s inherent vulnerabilities?
“Yeah, I do. I think kids shouldn’t be online as young as they are. Especially because it’s just so open. It’s like a playground for anyone. It’s a playground for kids. They’ve got movies, they’ve got games and all this kind of stuff. And it’s a playground for the other guys who are like ‘great, I’ve got access to these kids and if I’m careful, and I cover my tracks, no one knows I’m doing it’.”
VT: What, in your opinion, should parents do to protect their children online?
“I would limit it, time-wise. That’s quite an easy first step. I would also limit it to phones and tablets because Windows is a very easy thing to hack into. Because it’s so widespread, there are so many vulnerabilities that are well known and sold on, it’s quite insecure by nature.
“Whereas Apple, iPhones, Samsung tablets - they’re less vulnerable. More so iOS. They’re not as vulnerable. I would also be careful about buying internet-connected devices, such as baby monitors and kid laptops. There was a company that made kid laptops aimed at two to seven-year-olds, to learn your numbers and that kind of stuff. There was a vulnerability it that allowed anyone on the internet to look through the webcam, control it, add messages and they’re not secure at all. They’re just sold on cheap to parents.”
Andrew now works on the corporate side of cyber security but is acutely aware of the life experience he gained while working for the police. Looking over this kind of material is surely an upsetting job but, inevitably, someone has to do it.